On 27 June 2023, the Department of Health and Human Services (HHS), Office of Inspector General (OIG) posted its long-awaited final rule (CMP Final Rule) related to the federal information blocking regulations and the issuance of civil monetary penalties (CMPs).¹ Enforcement of CMPs outlined in the CMP Final Rule will begin 60 days after publication in the Federal Register – as publication should occur in short order, we anticipate enforcement will likely begin the first part of September, 2023.

Key Takeaways 

• The CMP Final Rule sets forth penalties, created by the 21st Century Cures Act (the Cures Act), that can be imposed against developers of health information technology certified by the Office of the National Coordinator for Health IT (ONC) (“health IT developers”) as well as health information networks (HIN) and health information exchanges (HIE) that violate information blocking regulations.² 

• Penalties can reach US$1,000,000 per violation, defined as a “practice” that constitutes information blocking; OIG has substantial discretion to determine the amount of the penalty based on a series of priorities when investigating information blocking claims. 

• Enforcement against health care providers is not addressed in the CMP Final Rule (except where a provider is also a health IT developer, HIN, or HIE); this will be addressed in future rulemaking.

• Health IT developers that have at least one ONC-certified health IT module (other than health care providers who self-develop health IT for their own use) are subject to the information blocking regulations and should take note of those requirements and the CMP Final Rule.  

• Separately, the CMP Final Rule also modifies 42 CFR parts 1003 and 1005 by adding Cures Act statutory provisions that amended the Civil Monetary Penalties Law (CMPL) related to fraud and other misconduct involving HHS grants, contracts, and other agreements and increasing CMPL penalty amounts effectuated by the Bipartisan Budget Act of 2018.³ 

Background and Additional Detail

The Cures Act authorized CMPs for any practice that constitutes information blocking, defined as: 

“any practice that is likely to interfere with, prevent, or materially discourage access, exchange, or use of electronic health information (EHI) if the practice is conducted by an entity that is: a developer of certified health information technology (IT); offering certified health IT; a health information exchange (HIE); or a health information network (HIN) and the entity knows or should know that the practice is likely to interfere with, prevent, or materially discourage the access, exchange, or use of EHI.” ⁴ 

On 1 May 2020, ONC published a final rule that promulgated regulations defining information blocking and other relevant terms and establishing exceptions (ONC Final Rule). While the ONC Final Rule referenced CMPs and other penalties required by the Cures Act, it did not describe the parameters and procedures applicable to the imposition of CMPs for information blocking, nor did it revise the CMP regulations.

OIG emphasizes in the CMP Final Rule that it coordinated “extensively” with ONC to ensure that the CMP Final Rule is aligned with the ONC Final Rule, and that stakeholders should read the two rules in tandem. To that effect, the CMP Final Rule: 

1. authorizes OIG to impose CMPs of not more than US$1,000,000 per violation against health IT developers of certified health IT and HIEs/HINs that commit information blocking;⁵  

2. defines “violation” as a practice that constitutes information blocking;⁶ and 

3. identifies factors specific to information blocking that OIG will consider in assessing information blocking penalties. 

These factors, which are similar to the factors that OIG indicates in the preamble to the CMP Final Rule as informing how OIG will prioritize investigations, are: 

1. the number of patients affected; 

2. the number of providers affected; 

3. the number of days the information blocking persisted; and 

4. the harm resulting from the information blocking, as measured by factors (1) through (3). 

Health Care Provider Penalties Not Addressed in This Rulemaking

The CMP Final Rule does not implement the portion of the Cures Act that indicates that health care providers engaged in information blocking practices shall be subject to “appropriate disincentives,” which HHS shall set forth through notice and comment rulemaking.⁷ However, OIG notes in the CMP Final Rule that a health care provider that meets the definition of health IT developer or HIE/HIN determined by OIG to have committed information blocking could be subject to CMPs. OIG further states that, while the CMP Final Rule includes “an informational statement” regarding how OIG anticipates it will approach information blocking enforcement, such commentary is limited to OIG’s investigation of entities subject to CMPs, and “does not apply to the investigations of health care providers that may be referred for disincentives” under the Cures Act. On this subject, OIG clarifies that HHS is developing a separate notice of proposed rulemaking to establish “appropriate disincentives” for health care providers.

OIG Enforcement Priorities

In describing its anticipated priorities in enforcing information blocking rule CMPs, OIG indicates it will prioritize conduct that:

• Resulted in, is causing, or had the potential to cause patient harm;

• Significantly impacted a provider’s ability to care for patients;

• Was of long duration;

• Caused financial loss to federal health care programs or other government or private entities; or

• Was performed with actual knowledge.

In outlining its anticipated priorities, OIG emphasizes six main points: 

1. There “is no specific formula” applicable to every information blocking allegation; rather, these priorities will assist OIG in effectively allocating its resources to “target information blocking allegations that have more negative effects on patients, providers, and health care programs.”

2. OIG will reassess enforcement priorities as it gains more experience in investigating and enforcing information blocking.

3. In reviewing allegations, OIG will coordinate closely, as appropriate, with ONC and other agencies, including the Office for Civil Rights, as well as the Federal Trade Commission for potential anti-competitive practices (see #6 below). 

4. Patient harm is not limited to individual patients, but “may broadly encompass harm to a patient population, community, or the public.”

5. Actual knowledge is not required to prove information blocking, but will assist in determining the severity of conduct that results in information blocking. 

6. Anticipated enforcement priorities will include reviewing both individual claims and allegations as well as patterns of claims or investigations; either may lead to investigations of anti-competitive conduct or unreasonable business practices, “such as unconscionable or one-sided business terms for the access, exchange, or use of EHI, or the licensing of an interoperability element.”

OIG also addresses whether it will implement enforcement approaches that provide alternatives to CMPs; whether potential noncompliance with other federal laws as a result of information blocking practices will be investigated or referred; and whether OIG will create a self-disclosure protocol to allow actors to self-disclose and resolve potential CMP liability related to conduct that constitutes information blocking, including the benefits of such approach. The CMP Final Rule provides helpful insight into OIG’s approach in enforcing information blocking against health IT developers and HIEs/HINs.